Repository navigation
fix: compare enum fields by name in Qute templates - #331
Open
Abhayanthk wants to merge 3 commits into
Open
Abhayanthk wants to merge 3 commits into
Abhayanthk wants to merge 3 commits into
Conversation
`commonExpositions.type` is an ExpositionType enum, but the web app template compared it to the String "INGRESS". The condition never matched, so grpc.server.certChainFilePath and grpc.server.privateKeyFilePath were never rendered, even with the default INGRESS exposition. Compare `type.name` instead, as done for the Kafka authentication type in microcks#306. Fixes microcks#330 Signed-off-by: Abhayanth K <abhayanth2006@gmail.com>
`credentialsType` is the AmazonCredentialsProviderType enum, but the SQS and SNS conditions compared it to the String 'profile'. They never matched, so credentials-profile-name and credentials-profile-location were never rendered. Compare `credentialsType.name` instead, as done for the Kafka authentication and exposition types. The SNS condition also checked `sqs.credentialsSecretRef` instead of `sns.credentialsSecretRef`. Refs microcks#330 Signed-off-by: Abhayanth K <abhayanth2006@gmail.com>
Fail when an {#if} or {#else if} condition compares an expression with
a string literal and that expression resolves to an enum through the
@CheckedTemplate parameter types. Qute never finds an enum equal to a
String, so such a condition silently never matches (microcks#330). Expressions
that cannot be resolved also fail the test, so they get checked by hand.
Refs microcks#330
Signed-off-by: Abhayanth K <abhayanth2006@gmail.com>
Contributor
Author
|
/cc @lbroudoux PTAL when you have time. |
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Several template conditions compared an enum field with a string, for example {#if spec.commonExpositions.type == "INGRESS"}. In Qute an enum is never equal to a String, so these conditions were always false. Because of this, the web app never got its gRPC TLS properties, even with the default INGRESS exposition, and the async minion never got its SQS and SNS profile credentials settings.
This PR compares the enum's name instead, as #306 did for the Kafka authentication type. It also fixes the SNS condition, which checked the SQS secret by mistake.
To keep this from happening again, it adds a test that scans every template and fails when a condition compares an enum with a string.
With this change, the web app's gRPC server uses the certificate the operator already generates, so gRPC traffic is encrypted (TLS) on default installs, as with the Helm chart.
Profile credentials also need their secret mounted in the async-minion pod, which the operator does not do yet. I'll open a separate issue for that.
Tests
MicrocksConfigMapDependentResourceTest:INGRESSrenders both gRPC TLS properties,NONEandGATEWAYROUTErender neither.AsyncMinionConfigMapDependentResourceTest: SQS and SNS profile credentials render their profile name and location (including SNS with only its own secret),env-variablerenders neither.QuteTemplateEnumComparisonTest: onmainit reports exactly the three broken conditions, on this branch it passes.mainand pass with the fix. Full operator suite on a k3s cluster: 24 tests, 0 failures.MicrocksCR with default exposition settings, Keycloak off to save memory): onmainthe gRPC port 9090 does not speak TLS, with the fix it completes a TLS handshake using the generated certificate.Related issue(s)
Fixes #330
I used AI tools while working on this and verified everything myself.